{"id":"CVE-2026-42334","aliases":["BIT-mongoose-2026-42334","CLSA-2026-1783558972","CLSA-2026-1785380887","EUVD-2026-30349","GHSA-wpg9-53fq-2r8h","ROOT-APP-NPM-CVE-2026-42334"],"status":"published","title":"Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00274,"percentile":0.1997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2026-05-05T21:48:06Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"mongoose","fixed_in":["6.13.9","7.8.9","8.22.1","9.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mongoose","fixed_in":["6.13.9","7.8.9","8.22.1","9.1.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"mongoose","fixed_in":["7.8.8-tuxcare.2","6.12.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"mongoose","fixed_in":["5.13.23-aikido.1","6.13.8-aikido.1","8.13.1-aikido.1","8.21.0-aikido.1","6.9.1-aikido.3","6.9.1-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/mongoose","fixed_in":["5.13.23-root.io.1","6.13.8-root.io.1","8.13.1-root.io.1","8.21.0-root.io.1","6.9.1-root.io.3","6.9.1-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.8.8"},{"fixed":"7.8.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.22.0"},{"fixed":"8.22.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.1.5"},{"fixed":"9.1.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.9"},{"introduced":"7.0.0"},{"fixed":"7.8.9"},{"introduced":"8.0.0"},{"fixed":"8.22.1"},{"introduced":"9.0.0"},{"fixed":"9.1.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.8.8-tuxcare.0"},{"fixed":"7.8.8-tuxcare.2"}]}],"versions":["7.8.8","7.8.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.2-tuxcare.0"},{"fixed":"6.12.2-tuxcare.4"}]}],"versions":["6.12.2","6.12.2-tuxcare.1","6.12.2-tuxcare.2","6.12.2-tuxcare.3"]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.9"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.9"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.22.1"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.1.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.23-aikido.1"},{"fixed":"6.13.8-aikido.1"},{"fixed":"8.13.1-aikido.1"},{"fixed":"8.21.0-aikido.1"},{"fixed":"6.9.1-aikido.3"},{"fixed":"6.9.1-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.23-root.io.1"},{"fixed":"6.13.8-root.io.1"},{"fixed":"8.13.1-root.io.1"},{"fixed":"8.21.0-root.io.1"},{"fixed":"6.9.1-root.io.3"},{"fixed":"6.9.1-root.io.4"}]}]}],"products":[{"vendor":"automattic","product":"mongoose"},{"vendor":"mongoosejs","product":"mongoose"}],"references":[{"url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()","tags":["web"]},{"url":"https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42334","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wpg9-53fq-2r8h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42334.json","tags":["advisory"]},{"url":"https://github.com/Automattic/mongoose","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42334","title":"Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","status":"published","published":"2026-05-14T18:03:43.196Z","modified":"2026-05-14T18:18:06.935Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-30349","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","status":"published","published":"2026-05-14T18:03:43Z","modified":"2026-05-14T18:18:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:04:31.113278Z"}],"ghsa":[{"id":"GHSA-wpg9-53fq-2r8h","title":"Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"### Impact\n\nThis vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.\n\nWhen sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.\n\nThis may lead to:\n\n- Authentication bypass\n- Unauthorized data access\n- Data exfiltration\n\n**Affected users:**\n\nApplications that:\n\n- Explicitly enable sanitizeFilter\n- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors\n\nApplications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.\n\n### Patches\n\nPatches have been released for all supported Mongoose release lines:\n\n- `^6.13.9`\n- `^7.8.9`\n- `^8.22.1`\n- `^9.1.6`   \n\n### Workarounds\n\nDelete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.\n\n### Resources\n\nsanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()\n\nOriginal blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html","status":"published","published":"2026-05-05T21:48:06Z","modified":"2026-05-14T20:53:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-42334","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","status":"published","published":"2026-05-14T18:16:47.747Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-42334","title":"Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","status":"published","published":"2026-05-14T18:03:43.196Z","modified":"2026-10-28T02:31:02.262799152Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-wpg9-53fq-2r8h","title":"Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"### Impact\n\nThis vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.\n\nWhen sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.\n\nThis may lead to:\n\n- Authentication bypass\n- Unauthorized data access\n- Data exfiltration\n\n**Affected users:**\n\nApplications that:\n\n- Explicitly enable sanitizeFilter\n- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors\n\nApplications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.\n\n### Patches\n\nPatches have been released for all supported Mongoose release lines:\n\n- `^6.13.9`\n- `^7.8.9`\n- `^8.22.1`\n- `^9.1.6`   \n\n### Workarounds\n\nDelete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.\n\n### Resources\n\nsanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()\n\nOriginal blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html","status":"published","published":"2026-05-05T21:48:06Z","modified":"2026-05-18T08:11:23.589007268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"BIT-mongoose-2026-42334","title":"Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","status":"published","published":"2026-05-18T05:48:06.036Z","modified":"2026-09-08T08:48:14.522126018Z","updated_at":"2026-11-02T15:28:33.469426Z"},{"id":"CLSA-2026-1783558972","title":"TuxCare security update for mongoose (1 CVE)","description":"TuxCare rebuilt mongoose to address 1 CVE. Fixed in 7.8.8-tuxcare.2.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:03.772820022Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785380887","title":"TuxCare security update for mongoose (2 CVEs)","description":"TuxCare rebuilt mongoose to address 2 CVEs. Fixed in 6.12.2-tuxcare.4.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:48:03.922020545Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"ROOT-APP-NPM-CVE-2026-42334","title":"CVE-2026-42334 in mongoose - Patched by Root","description":"Root has patched CVE-2026-42334 in the mongoose package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-01T06:57:58Z","modified":"2026-09-01T09:15:06.276561989Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}